Chainalysis 2026 Report: State-Level Crypto Crime Surges 694%

ByVictor

📋 En bref (TL;DR)

  • Record volume: illicit crypto addresses received at least $154 billion in 2025, a 162% increase year-over-year.
  • State-level sanctions evasion: sanctions circumvention by state actors surged 694%, with $104 billion received by sanctioned entities.
  • Russian stablecoin A7A5: this ruble-pegged token processed $93.3 billion in less than a year, enabling Russian companies to trade despite sanctions.
  • Iran and crypto: Iranian crypto flows exceeded $3 billion in 2025, with withdrawal spikes reaching 873% following the American-Israeli strikes in February 2026.
  • Ransomware declining: ransom payments dropped 8% to $820 million, despite a 50% increase in the number of attacks.
  • AI-powered scams: scams leveraging artificial intelligence are 4.5 times more profitable than traditional schemes, with average payouts up 253%.
  • Chinese money laundering: Chinese-speaking networks laundered $16.1 billion in crypto in 2025, roughly $44 million per day.

Each year, the Chainalysis Crypto Crime Report provides a comprehensive overview of cryptocurrency-related crime. The 2026 edition, covering 2025 data, reveals a deep transformation of the criminal landscape. The total volume of illicit transactions reached at least $154 billion, a historic record representing a 162% increase over 2024. But the most striking figure is the 694% surge in sanctions circumvention by state actors.

This 88-page report goes far beyond listing statistics. It documents a structural transformation: crypto crime is no longer the domain of lone hackers or petty scammers. It has become industrialized, professionalized, and above all, weaponized by nation-states. Russia, Iran, North Korea: these powers are integrating cryptocurrencies into their strategic financial infrastructure.

Sanctions Evasion: The Main Driver of Crypto Crime

The most significant finding of the 2026 report is undeniably the explosion in the circumvention of international economic sanctions through cryptocurrencies. Sanctioned entities received $104 billion in 2025, compared to approximately $13 billion the previous year, a staggering 694% increase.

This surge is no accident. It reflects a deliberate decision by several states to use cryptocurrencies as a parallel financial infrastructure to evade restrictions imposed by the United States, the European Union, and their allies.

The Russian A7A5 Stablecoin: $93 Billion in Less Than a Year

The most striking example is the A7A5 token, a stablecoin pegged to the Russian ruble. Launched in February 2025 by the Kyrgyz-based company Old Vector, this token processed $93.3 billion in transactions in less than a year. It functioned as a settlement rail allowing sanctioned Russian companies to conduct cross-border trade.

The A7A5 token alone accounts for approximately $72 billion of the total sanctions evasion volume, nearly 70% of this category. In August 2025, the US OFAC and the UK OFSI designated entities linked to A7A5, including the Grinex platform and issuer Old Vector. The European Commission followed in October 2025 with its 19th sanctions package, directly prohibiting transactions involving this token.

Iran: Over $3 Billion in State-Level Crypto Flows

Iran is the second major case of state-level sanctions evasion through cryptocurrencies. According to Chainalysis, the Iranian crypto ecosystem reached approximately $7.8 billion in 2025, with a growing share controlled by the state.

In the fourth quarter of 2025, addresses linked to the Islamic Revolutionary Guard Corps (IRGC) and its proxy networks accounted for over 50% of the value received by Iranian crypto entities. In total, these networks moved over $3 billion, funding militias, oil-related activities, and the purchase of dual-use equipment.

A revealing episode occurred in late February 2026, when American-Israeli strikes triggered a massive spike in crypto withdrawals from Iranian platforms. Within days, $10.3 million was withdrawn, with hourly flows reaching 873% above the normal average. This behavior illustrates how cryptocurrencies serve as a safety valve during geopolitical crises.

Stablecoins: 84% of Illicit Transactions

The report highlights a major technological shift in crypto crime. Stablecoins, tokens whose value is pegged to a fiat currency such as the dollar, now account for 84% of all illicit transactions. This figure confirms that criminal actors favor the stability and liquidity of stablecoins for moving funds at scale.

This trend poses a considerable regulatory challenge. The FATF (Financial Action Task Force) issued a warning in March 2026 highlighting the growing role of stablecoins in sanctions evasion and money laundering.

Ransomware: Fewer Payments, but a Surge in Attacks

Paradoxically, ransomware payments declined in 2025 despite an explosion in the number of attacks. Victims paid approximately $820 million, an 8% decrease compared to 2024. However, this figure could be revised upward, as Chainalysis estimates the actual total will likely approach $900 million as more incidents are attributed.

The number of ransomware attacks, on the other hand, surged 50% year-over-year, setting a new record. But the victim payment rate hit an all-time low of just 28%. This divergence is explained by improved incident response capabilities, stronger regulation, and better preparedness among targeted organizations.

Despite this overall decline, individual ransoms have skyrocketed. The median payment rose 368% year-over-year, reaching nearly $60,000. Criminal groups are concentrating their attacks on higher-value targets, demanding larger sums from a smaller number of victims willing to pay.

Scams and Fraud: Artificial Intelligence Changes the Game

Cryptocurrency-related scams continue to grow in scale and sophistication. The report estimates crypto scam losses at approximately $17 billion in 2025. The average payment per victim rose from $782 in 2024 to $2,764 in 2025, a 253% increase.

The most concerning factor is the increasing integration of artificial intelligence into scam operations. AI-powered scams prove to be 4.5 times more profitable than traditional methods. Chainalysis warns that we are heading toward a future where virtually all scams will incorporate AI to some degree.

Pig butchering scams and Ponzi schemes remain the dominant categories by volume. However, there is a growing convergence between different types of fraud, with scammers combining SMS phishing, identity theft, and sophisticated laundering networks.

Chinese Money Laundering Networks: $16 Billion Processed

The emergence of Chinese-speaking money laundering networks is another key finding of the 2026 report. These Chinese Money Laundering Networks (CMLNs) processed $16.1 billion in 2025, roughly $44 million per day through over 1,799 active wallets.

These networks increased their share of identified laundering activity to approximately 20% in 2025. Since 2020, inflows to CMLNs have grown 7,325 times faster than those to centralized exchanges. They now offer a full-service laundering operation, covering scams, North Korean stolen funds, sanctions evasion, and even terrorism financing.

Theft and Hacking: North Korea and the Bybit Mega-Hack

Cryptocurrency theft remains a major threat. North Korea-linked hackers alone stole $2 billion in 2025. The most notable event was the exploit against the Bybit exchange in February 2025, with nearly $1.5 billion stolen — the largest digital heist in cryptocurrency history.

In total, hacking-related losses reached $3.4 billion in 2025. The professionalization of North Korean operators, who reinvest stolen funds into the regime’s nuclear and ballistic programs, represents a security challenge that extends far beyond financial markets.

Evolving Dark Markets: From Fentanyl to Fraud

Darknet market-related flows reached nearly $2.6 billion in 2025, continuing a steady increase since 2022. However, the report notes a significant shift in the nature of illicit activities.

Crypto flows to fentanyl precursor suppliers began declining from mid-2023, foreshadowing the substantial decrease in overdose deaths recorded in official statistics from late 2023 onward. Brokers moved away from American, Mexican, and Canadian clients, and sites that hosted these listings gradually stopped offering them.

Meanwhile, fraud shops underwent a transformation, with Chinese-speaking operations consolidating toward higher-value wholesale activities. Dark markets nonetheless remain resilient: when a platform is taken down, buyers and sellers quickly migrate to new structures.

What Should Investors Take Away From This Report?

The Chainalysis 2026 report should not discourage retail investors, but it should prompt them to remain vigilant. The vast majority of the $154 billion in illicit transactions is tied to state-level sanctions evasion, a phenomenon that does not directly affect individual users. However, AI-powered scams and ransomware attacks impact everyone.

Using regulated platforms, enabling two-factor authentication, being wary of returns that seem too good to be true, and never sharing your private keys remain the golden rules for any cryptocurrency holder.

Glossary

  • Chainalysis: a US-based company specializing in blockchain data analysis, providing traceability tools to governments, law enforcement, and crypto industry businesses.
  • Stablecoin: a cryptocurrency whose value is pegged to a stable asset, typically the US dollar. The most well-known are USDT (Tether) and USDC (Circle).
  • Economic sanctions: restrictive measures imposed by states or international organizations to limit trade and financial exchanges with certain countries, entities, or individuals.
  • Ransomware: malicious software that encrypts a victim’s data and demands the payment of a ransom, often in cryptocurrency, to unlock it.
  • Money laundering: the process of concealing the illicit origin of funds by routing them through legitimate or complex financial channels.
  • Cryptocurrency: a digital asset operating on a blockchain, using cryptography to secure transactions. Bitcoin and Ethereum are the most well-known.
  • Darknet: a part of the internet accessible only through specialized software (such as Tor), often used for anonymous activities, both legal and illicit.

{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”What is the total amount of crypto crime in 2025 according to Chainalysis?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”According to the Chainalysis 2026 report, illicit crypto addresses received at least $154 billion in 2025, a 162% increase over 2024. This figure is considered a lower bound, with the actual amount likely being higher.”}},{“@type”:”Question”,”name”:”Why did crypto sanctions evasion increase by 694%?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”This 694% surge is primarily due to the systematic adoption of cryptocurrencies by states like Russia and Iran to circumvent international sanctions. The Russian stablecoin A7A5 alone processed $93.3 billion in less than a year.”}},{“@type”:”Question”,”name”:”Did ransomware payments increase in 2025?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”No, ransomware payments decreased 8% to approximately $820 million in 2025, despite a 50% increase in the number of attacks. The victim payment rate hit an all-time low of 28%, thanks to better organizational preparedness.”}},{“@type”:”Question”,”name”:”What role does artificial intelligence play in crypto scams?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”AI has become a major tool for crypto scammers. AI-powered scams are 4.5 times more profitable than traditional methods. The average payment per victim rose from $782 to $2,764 in a year, a 253% increase.”}},{“@type”:”Question”,”name”:”How can you protect yourself against crypto scams in 2026?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”The essential rules are: use regulated platforms, enable two-factor authentication, never share your private keys, be wary of unusually high returns, and verify the identity of anyone you interact with. AI-powered scams make vigilance even more critical.”}}]}

Frequently Asked Questions

What is the total amount of crypto crime in 2025 according to Chainalysis?

According to the Chainalysis 2026 report, illicit crypto addresses received at least $154 billion in 2025, a 162% increase over 2024. This figure is considered a lower bound, with the actual amount likely being higher.

Why did crypto sanctions evasion increase by 694%?

This 694% surge is primarily due to the systematic adoption of cryptocurrencies by states like Russia and Iran to circumvent international sanctions. The Russian stablecoin A7A5 alone processed $93.3 billion in less than a year.

Did ransomware payments increase in 2025?

No, ransomware payments decreased 8% to approximately $820 million in 2025, despite a 50% increase in the number of attacks. The victim payment rate hit an all-time low of 28%, thanks to better organizational preparedness.

What role does artificial intelligence play in crypto scams?

AI has become a major tool for crypto scammers. AI-powered scams are 4.5 times more profitable than traditional methods. The average payment per victim rose from $782 to $2,764 in a year, a 253% increase.

How can you protect yourself against crypto scams in 2026?

The essential rules are: use regulated platforms, enable two-factor authentication, never share your private keys, be wary of unusually high returns, and verify the identity of anyone you interact with. AI-powered scams make vigilance even more critical.

Sources

This article is based on the following sources:

How to cite this article: Fibo Crypto. (2026). Chainalysis 2026 Report: State-Level Crypto Crime Surges 694%. Retrieved March 9, 2026 from fibo-crypto.fr

Related Articles